Dartmouth's $750,000 Oracle Breach Settlement Covers 96,911 People — $7.74 a Head in the Fund — and Its $75 Estimate Only Survives Up to Roughly 5,300 Cash Claims. 2,987 Forms Were Already In by September 18. Claims Close October 21.

If you have Dartmouth's letter or the settlement email in front of you, the practical part first: the claim deadline is October 21, 2026. Online claims at OracleDartmouthDataSettlement.com need the Unique ID and PIN printed in the Email Notice or Postcard Notice and must be in by 11:59 p.m. Central time; paper claims go to the administrator's post office box in Portland, Oregon. There is no fee and no lawyer involved in filing.

The facts behind it come from the court papers. The settlement papers recite that “on or before August 9, 2025, the cybercriminal syndicate CL0P exploited a vulnerability in the Oracle EBS software” — Oracle E-Business Suite, which Dartmouth uses for administrative work such as human resources and financial transactions — and that Dartmouth discovered the incident on October 1, 2025. Dartmouth's own notice letter, as quoted in the consolidated complaint, says: “Through the investigation, we determined that an unauthorized actor took certain files between August 9, 2025, and August 12, 2025.” Letters began going out on November 24, 2025. The settlement defines the data as “some combination of the following: names, dates of birth, Social Security numbers, and/or financial account information.” The complaint further alleges that Cl0p listed Dartmouth on its leak site around November 13, 2025 and later posted about 210.78 gibibytes of data; those are allegations, not findings.

Why a Texas court for a New Hampshire college? Three Dartmouth-only lawsuits were filed in federal court in New Hampshire between November 26 and December 10, 2025, and all three were voluntarily dismissed in January 2026, according to the dockets. The claims were pursued instead in Austin, where the Oracle cases were consolidated on January 5, 2026 as In re Oracle Corporation Data Breach Litigation. A consolidated complaint on March 6, 2026 named Matthew Ross, a former Dartmouth student, and Lisa Mabey as the plaintiffs against Dartmouth. After a full-day mediation with JAMS mediator Bruce A. Friedman on April 3, 2026, the parties agreed on $750,000. Judge Albright granted preliminary approval on July 1, 2026, and class counsel filed for final approval on September 21. Dartmouth denies wrongdoing; the court has not decided who was at fault.

The class, word for word: “all living individuals residing in the United States who were sent notice by Dartmouth that their Private Information may have been impacted in the Data Incident.” Excluded are Dartmouth's directors, officers, members and agents, government entities, the judge and court staff, anyone convicted of causing the incident, and people who opt out. The test is the letter, not your role: the complaint describes one representative as a former student and the other as a former patient of Dartmouth Hitchcock Medical Center who received the college's November 24 notice.

How notice went out, according to the administrator's sworn declaration: Epiq received 99,159 records on July 10, deduplicated them to 96,911 unique people, and from July 31 sent 184,315 emails to 68,907 of them. From August 26 it mailed 34,807 double postcards with a detachable claim form to people without a working email. As of September 17, notice had reached 90,179 people, “approximately 93%”. (The motion itself cites 94,035 as of September 9; we use the declaration.) By our count that leaves roughly 6,700 class members with no confirmed delivered notice — including 17 records that had no email or postal address at all.

Is the email real? The Email Notice filed with the court came from Oracle Dartmouth Data Settlement Administrator <OracleDartmouthDataSettlement@e.epiqnotice.com> under the subject “In re Oracle Data Breach Litigation Notice of Dartmouth Settlement”, with a Unique ID and PIN at the top. The postcard's return address is the settlement administrator, PO Box 2312, Portland, OR 97208-2312. The official claim form asks for your name, mailing address, phone, email, the Unique ID, and the email or phone tied to a PayPal, Venmo or Zelle account. It does not ask for a Social Security number or a bank account number. If you would rather not click a link, type the address yourself.

No email and no postcard? The claim page is explicit: “If you did not receive the Notice, you can submit a claim by mail.” The paper Claim Form is on the site's Documents page, or can be requested at 1-877-357-7730. If you have Dartmouth's November 2025 letter, keep it with your claim papers.

Three benefits, and you do not have to choose between the two cash options.

Cash Payment A — Documented Losses: up to $5,000 per class member for out-of-pocket losses related to the incident. The agreement's summary clause is narrower than the notice (its detailed paragraph repeats the notice's wording) — costs “fairly traceable to the Incident and resulting from fraud and/or identity theft”. The claim form's examples: professional fees for falsified tax returns or account fraud, credit freeze or unfreeze receipts, statements with unauthorized charges, bank fees, credit reports and monitoring you bought, plus postage, notary and mileage. “Personal certifications, declarations, or affidavits from you do not constitute reasonable documentation”, and anything already reimbursed — including through the product offered in Dartmouth's notification letter — is excluded. By filling in the boxes you certify the money does not relate to other breaches.

Cash Payment B — Pro Rata Cash: no documents, “a pro rata (a legal term meaning equal share) Cash Payment in the estimated amount of $75.” The settlement agreement says that amount “may be increased or decreased based on the total dollar amount of all Valid Claims received”, and the notice spells out the order: administration costs, Cash Payment A claims, credit monitoring, attorneys' fees and costs, and service awards are paid first. The form lets you claim both, and that matters: if your documentation is rejected and you do not cure it, the form is processed as a Cash Payment B claim — but only if you also claimed B.

Credit monitoring: two years with one credit bureau, dark web monitoring, $1,000,000 of identity theft insurance, $1,000,000 of unauthorized electronic funds transfer reimbursement, and freeze assistance. Activation instructions come by email after the settlement is final. The documents we read do not name the provider.

How cash is paid: the claim form offers PayPal, Venmo or Zelle only. Under the agreement, money that cannot be delivered because a claimant gave wrong information is forfeited. Funds still left 120 days after payments go out buy extra credit monitoring for monitoring claimants. The fund is non-reversionary: nothing goes back to Dartmouth once the settlement takes effect.

Most summaries stop at “$75”. The court filings let you check it. The administrator counted 96,911 unique class members, so the $750,000 fund works out to $7.74 per person before anything is taken out — our arithmetic.

What comes out first is in the September 21 motion. Class counsel ask for $250,000 in fees (one-third), $30,044.81 in costs and $3,000 each for the two representatives. Together that is $286,044.81, or 38 percent of the fund, if the court grants it all on November 5. Counsel put their time at 216.5 hours with a lodestar of $225,744.60 and call the request a 1.12 multiplier (by our arithmetic, 1.11). Epiq's administration bill was $68,001.01 through August — “not a minimum or a cap” — against a preliminary estimate of $142,000. That leaves between about $322,000 and $396,000 for documented losses, monitoring and the $75 payments, or $3.32 to $4.09 per class member.

At $75 a head, that money covers roughly 4,300 to 5,300 cash claims — 4.4 to 5.4 percent of the class — before a single monitoring enrollment or documented-loss payment. The administrator reported 2,987 claim forms (2,020 online, 967 paper) as of September 18, already 3.1 percent, with 33 days still to go at that point. Epiq said the numbers are “preliminary and are subject to change” and that duplicates and denials may reduce them.

These are ceilings: monitoring enrollments and documented-loss payments come out of the same pool first, so every figure is lower in practice. They also assume the court awards the full fees; any amount it cuts stays in the fund for the class. Not every claim form is a cash claim, so 2,987 forms do not mean 2,987 cash claims. The math still points one way. The $75 holds only while cash claims stay below roughly 4.4 to 5.4 percent of the class, and less once monitoring and documented losses are paid. If one class member in ten files, it falls to roughly $32 to $40 before those deductions. Filing is free either way, and the $5,000 documented track is paid before the $75 track, so it does not shrink as more people file for the $75 — it could only be cut if documented losses and monitoring alone used up the fund.

Four dates matter; all are still ahead as of September 25, 2026.

Two fine-print points. The notice and FAQ say mailed claims must be postmarked by October 21, but the online claim page says forms must be “received by the Settlement Administrator no later than October 21, 2026.” Mail at least a week early, as the FAQ itself advises. Objectors must also disclose any artificial intelligence used to research or draft the objection — a requirement written into the court's preliminary approval order. As of September 18, Epiq had one opt-out and no objections.

When money moves — our reading of the agreement's clocks, not a promise. If Judge Albright approves on November 5 and nobody objects, the Effective Date is the next day. Epiq has 30 days from the claim deadline to reject claims for fraud or duplication. It must pay no later than 30 days after the Effective Date or the end of its validity review, whichever is later. By our arithmetic the best case is payment due around December 20, 2026 (November 20 plus 30 days). An objection moves the Effective Date to 30 days after the approval order, which pushes that into early January 2027; an appeal adds months.

Not this case: (1) Other Oracle EBS victims. The same consolidated complaint names Oracle and other EBS customers, among them the University of Pennsylvania, the University of Phoenix and The Washington Post's publisher. SecurityWeek reported Harvard's confirmation in October 2025. This settlement pays only Dartmouth's notice recipients, and it does not release Oracle: the agreement excludes from the released parties “Oracle Corporation and any other defendant presently named in the Action”. (2) Oracle's separate $115 million privacy settlement, Katz-Lacabe v. Oracle America in California, closed claims on October 17, 2024; its settlement site says payments were to start going out on September 21, 2026. (3) Dartmouth Health is not a defendant here; the only Dartmouth party is Trustees of Dartmouth College.

Contact: Epiq, 1-877-357-7730 (toll-free), info@OracleDartmouthDataSettlement.com, In re Oracle Corporation Data Breach Litigation, Re: Trustees of Dartmouth College, Settlement Administrator, PO Box 2312, Portland, OR 97208-2312. Class counsel: Jeff Ostrow (Kopelowitz Ostrow P.A.), Gary M. Klinger (Milberg PLLC), W. Mark Lanier (The Lanier Law Firm) and Joe Kendall (Kendall Law Group).